Skip to content

Harden Static Analysis Report against empty safe-output runs during MCP outages #27077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 2 commits into from
+13 −0
Closed

Harden Static Analysis Report against empty safe-output runs during MCP outages #27077

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb4eefd
Initial plan
Copilot Apr 18, 2026
0cb05a3
fix: add noop fallback guidance for static-analysis-report MCP outages
Copilot Apr 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/static-analysis-report.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,6 +394,19 @@ Issues created: [list of issue links for Critical/High findings, or "none"]

Use the title `[static-analysis] Report - [DATE]` for the issue.

### Safe-Output Reliability Fallback (Required)

If safe-output tool calls fail because MCP tools are unavailable (for example, gateway connection failures), you **must** still produce at least one safe output by writing a fallback `noop` entry directly to the safe-outputs JSONL file with Bash:

```bash
printf '{"type":"noop","message":"Static analysis completed but safe-output MCP tools were unavailable; no issue could be created."}\n' >> "${GH_AW_SAFE_OUTPUTS:-/tmp/gh-aw/safeoutputs/outputs.jsonl}"
```

Rules:
- Use this fallback only when `create_issue`/other safe-output tool calls are unavailable due infrastructure issues.
- Do not exit with zero safe outputs. Always ensure at least one valid safe output record exists.
- Keep the noop message concise and explicit about why action could not be taken.

### Phase 6: Analyze Runner-Guard Findings

Runner-guard has performed source-to-sink vulnerability scanning as part of the compile step. The results are included in the compilation output at `/tmp/gh-aw/compile-output.txt`.
Expand Down